# Logstash-\* unable to fetch mapping in kibana **URL:** \ **Category:** Logstash\ **Created:** [October 11, 2017, 6:14pm UTC](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-in-kibana/103593 "2017-10-11T18:14:40Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![maddie0726](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@maddie0726](https://discuss.elastic.co/u/maddie0726)\ **Post date:** [October 11, 2017, 6:14pm UTC](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-in-kibana/103593/1 "2017-10-11T18:14:40Z")
I have Logstash Kibana and Elasticsearch (all version 5.6.2) configured and running on Windows Server 2012 R2, running through a remote desktop connection. I am working on my logstash config file to read data from a .txt file and output to elasticsearch then to kibana. I can't figure out for the life of me why in kibana it says no matching indices for "logstash-\*". I am very new at this, so bear with me please! logstash.conf: input { file { path =\> "//ntsvc/logs/\*.txt" } } filter { grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601}%{SPACE}Local4.%{LOGLEVEL}%{SPACE}%{IP}%{SPACE}%{CISCOTIMESTAMP}%%{SYSLOGPROG} %{GREEDYDATA:message}" } } } output { elasticsearch { hosts =\> ["localhost:9200"] } } The only settings i changed in logstash.yml are: config.test\_and\_exit: true config.reload.automatic: true Some sample data from the .txt file (edited for sensitive information): 2017-09-18 00:00:01 Local4.Debug IP Sep 18 2017 00:00:01: %ASA-0-0000: UDP request discarded from IP to COVERT:IP I've tested the config file in PowerShell and it says the file is ok and all are running, I have a feeling I have something not configured correctly. Thank you in advance! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 17, 2017, 7:00pm UTC](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-in-kibana/103593/2 "2017-10-17T19:00:55Z")
Logstash is tailing the input file and waiting for more data. Please read the documentation about sincedb in the file input documentation and, in particular, check out the `sincedb_path` and `start_position` options. ---
**Author:** ![maddie0726](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@maddie0726](https://discuss.elastic.co/u/maddie0726)\ **Post date:** [October 18, 2017, 1:05pm UTC](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-in-kibana/103593/3 "2017-10-18T13:05:12Z")
Since I wrote the original post I added start\_position =\> "beginning" sincedb\_path =\> "/dev/null" to the input section of my config file and the issue still persists ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 18, 2017, 1:48pm UTC](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-in-kibana/103593/4 "2017-10-18T13:48:30Z")
Don't use /dev/null on Windows, use nul instead. ---
**Author:** ![maddie0726](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@maddie0726](https://discuss.elastic.co/u/maddie0726)\ **Post date:** [October 18, 2017, 2:17pm UTC](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-in-kibana/103593/5 "2017-10-18T14:17:18Z")
My entire conf is as follows: input { file { path =\> "\\ntsvc\Logs\*.txt" start\_position =\> "beginning" sincedb\_path =\> "NUL" ignore\_older =\> 0 } } filter { grok { #grok filter generated and working through pattern generator with my data } } output { elasticsearch { hosts =\> ["localhost:9200"] } } I still have no matching indices in kibana matching logstash-\* ---
**Author:** ![maddie0726](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@maddie0726](https://discuss.elastic.co/u/maddie0726)\ **Post date:** [October 18, 2017, 3:13pm UTC](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-in-kibana/103593/6 "2017-10-18T15:13:50Z")
I also tried changing the file path to forward slashes and still have the same problem. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 18, 2017, 3:25pm UTC](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-in-kibana/103593/7 "2017-10-18T15:25:48Z")
Are you running Logstash as a service? Can you try cranking up the loglevel to debug and see if you see anything interesting? There should be something containing "discover" that indicates what files are matched by the filename pattern. I also strongly suggest that you use a simple `stdout { codec => rubydebug }` output for now. ---
**Author:** ![maddie0726](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@maddie0726](https://discuss.elastic.co/u/maddie0726)\ **Post date:** [October 18, 2017, 3:51pm UTC](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-in-kibana/103593/8 "2017-10-18T15:51:08Z")
I'm not 100% sure I follow. I set the log.level to debug and ran the --config.debug command and looked through the debugged config file and didn't see anything containing "discover". I also changed to output to what you suggested. And yes I am running logstash as a service. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 18, 2017, 4:06pm UTC](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-in-kibana/103593/9 "2017-10-18T16:06:04Z")
> I'm not 100% sure I follow. I set the log.level to debug and ran the --config.debug command and looked through the debugged config file and didn't see anything containing "discover". Okay. Can you post the logfile somewhere? > And yes I am running logstash as a service. Last time I looked (years ago, but still) Windows services don't automatically have access to network paths. Can you try with a local file that you're sure Logstash has access to? ---
**Author:** ![maddie0726](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@maddie0726](https://discuss.elastic.co/u/maddie0726)\ **Post date:** [October 18, 2017, 4:13pm UTC](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-in-kibana/103593/10 "2017-10-18T16:13:19Z")
I will give the local file a try. But after debugging the first time, I tried to rerun the debug command so I can copy the debugged file and I'm getting a fatal error saying logstash could not be started because there is already another instance using the configured data directory. I don't know why, or how to fix that. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 18, 2017, 4:15pm UTC](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-in-kibana/103593/11 "2017-10-18T16:15:17Z")
Perhaps a lockfile was left in the data directory from the previous Logstash run (or you didn't actually kill that process). ---
**Author:** ![maddie0726](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@maddie0726](https://discuss.elastic.co/u/maddie0726)\ **Post date:** [October 18, 2017, 4:47pm UTC](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-in-kibana/103593/12 "2017-10-18T16:47:10Z")
I'm not sure what fixed it, but I found that lock file, deleted it, got output to powershell from my data so I changed the output back to elasticsearch et viola! I have a logstash Index!!! Thank you so so much for your help and patience with me! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 15, 2017, 4:47pm UTC](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-in-kibana/103593/13 "2017-11-15T16:47:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.